Security Software Virus problem urgent help

R

raja53352

Disciple
Hi guys

i have multiple folders in my system and found virus like KHATRA.exe,GHOST.exe explorer in taskmanager.It blocked control panel,my computer properties,regedit etc.I tried norton,Trendmicro antivirus to eliminate the same but clould not do it.Pls suggest me the tool to eliminate the same
Thankz
 
I installed,Updated the AVAST and kept for full system scan.It detected and deleted but evenever U restart it come back.Pls advise me where exactly in the file system it affects?like system32,registry.I planning to do manual remove.It affects more than 4 systems in our office
 
Use process explorer and find the threads of Virus and check the registry to remove it manually. Use safe mode if possible. Alternatively you can use latest Hiren's Boot CD and use the latest anti virus defs to remove them from DOS mode scan
 
Install Kaspersky Virus Removal Tool and run a full scan. After that do a restart, do another full system scan.

Thereafter, install Spybot Search and Destroy and do a full scan. It will ask for reboot after that. Once rebooted, u should be clear :)

A tip: When there is a virus attack, don't panic coz u will end up doing mistakes. So, keep your cool and try out these :)
 
clown_abhi said:
Install Kaspersky Virus Removal Tool and run a full scan. After that do a restart, do another full system scan.

Thereafter, install Spybot Search and Destroy and do a full scan. It will ask for reboot after that. Once rebooted, u should be clear :)

A tip: When there is a virus attack, don't panic coz u will end up doing mistakes. So, keep your cool and try out these :)
Click to expand...

+1 A perfect soultion and after doing all that just run CCleaner also it will remove all temp data and cache and free up your space and your pc will work as smoothly as before :)
 
boot ur computer in safe mode with networking....download autoruns from sysinternals.com, and tool icesword ( english version) from antirootkit.com...now using autoruns, check the logon, winlogon, and scheduled task tab and locate the file locations of the infections which are getting started while u boot the pc...delete the entries from autoruns and manually go to the locations to delete the files...

and if u r not able to delete any file use the tool iceword to force delete the files...

now go to the following locations manually windows, system32, drivers , etc...check for any files which are not having any valid company name and which come under recently modified..delete the suspicios files
use icesword to edit registry, and edit the respectie values to enable the disabled system features...u can search on internet for editng the key..use kelly's corner website for registry
or go to this location HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

delete the key which says DisableRegistryEditing or anything similar and after that go to kellys corner website and download respective registry patches

and fyi...its not a virus..its a worm...
 
Back
Top